Across the Internet, tectonic shifts are taking place, fundamentally changing the way personal data is collected, stored, and transferred, disrupting technological paradigms and markets. On the scale of decades, the costs of producing hardware and software have plunged, and the computational capacity, throughput, and bandwidth of Internet infrastructure has drastically increased. Cloud Computing Models. Fueled by these changes, cloud computing-which provides computational resources, software, and infrastructure as an on-demand service over the Internet-have become a common feature of the current landscape. Numerous products and services used by consumers are built on or integrate with cloud computing platforms. By extending software "into the cloud," today's products and services can offer consumers functionality and conveniences that were not possible fifteen years ago. For example, users are no longer limited by the amount of storage capacity on a device's hard drive; a user can, practically speaking, store an infinite amount of data through a cloud storage service and access it from anywhere over the Internet. Through an Internet connection, mobile and wearable devices with low-powered microprocessors can leverage the power of thousands of servers, neural networks, and machine learning algorithms to perform complex calculations. These features are often seamlessly integrated into a plethora of products and services, and the average consumer may not be aware of the mechanical underpinnings-they "just work." Consumer Data Held by Vendors and Service Providers. Another consequence of the shift towards cloud computing is that Internet companies are increasingly the caretakers and stewards of consumer data. 3 This happens in a few ways. As individuals and organizations use cloud computing services, their personal digital byproducts, such as old emails, messages, photos, and documents, are redundantly stored on vendor-owned infrastructure for indefinite periods of time. Not only is this convenient for consumers, but data has also become a commodity for Internet businesses as they mine and monetize large quantities of data about individuals. In these arrangements, online services may be offered for no cost to the user and subsidized entirely by revenue from advertising. Some of this data is biographic and transactional, including information like first and last names, email addresses, postal addresses, phone numbers, business records, and other information. However, an increasing amount of it could be described as behavioral and inference-based, such as a user's social graph and relations, their interests, personal preferences, browsing history, clickstream, geolocation, the probability they will fall ill 4 or are pregnant, 5 and much more. Needless to say, such data can be very personal and potentially sensitive.

Cross-border data access reform may be on the legislative agenda in late 2017, with recent House and Senate judiciary committee hearings revisiting the topic. 1 In light of this increasing interest, we thought it would be helpful to provide a brief primer on how cross-border data access requests currently work, options for reform, and major challenges to reform ahead. This document presents a short, high-level background review of the debate as it currently stands, particularly focusing on the DOJ's 2016 proposal for reform. Governments need evidence to investigate and prosecute crimes, but increasingly that evidence takes the form of data stored on the servers of U.S. tech companies. In July 2016, the U.S. Department of Justice (DOJ) released draft legislation that would address some of the challenges foreign governments face when seeking data related to criminal investigations from U.S. companies. 2 Interest in making such changes continues to grow, with relevant laws, including the Electronic Communications Privacy Act (ECPA), maybe seeing Congressional attention in late 2017, especially as the Foreign Intelligence Surveillance Act (FISA) comes up for renewal. To access electronic content-including email, social media messages, and more-held by U.S. companies, a foreign country currently relies primarily on the processes set out in agreements called Mutual Legal Assistance Treaties (MLATs), if that country has negotiated one with the U.S. 3 MLATs with the U.S. require countries to meet U.S. legal standards when making requests for electronic content data (see more details below and Diagram 1), with less strict standards for